Re: [PATCH v1] net: sock_reuseport: check program type on the migration path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] net: sock_reuseport: placeholder Signed-off-by trailer in
  commit message
--

commit cfe7ad076364a4b63b18cb16611dd2ffb1e3f230
Author: Linux kernel audit <audit@example.invalid>

> net: sock_reuseport: check program type on the migration path
>
> A BPF_PROG_TYPE_SOCKET_FILTER program can be loaded with
> expected_attach_type set to BPF_SK_REUSEPORT_SELECT_OR_MIGRATE and
> attached to a SO_REUSEPORT TCP group; both steps are allowed without
> CAP_BPF.  Closing a listener that still has queued children then runs
> that socket filter with a struct sk_reuseport_kern as its context,
> while the program was verified against struct sk_buff.  It reads and
> writes past the 56-byte object on the stack, which KASAN reports as a
> stack-out-of-bounds in ___bpf_prog_run().
>
> The cause is that reuseport_migrate_sock() decides from
> prog->expected_attach_type alone.  That field is supplied by user
> space and does not identify the program type, and
> bpf_prog_load_check_attach() does not reject the value for
> SOCKET_FILTER programs.
>
> Fix this by requiring BPF_PROG_TYPE_SK_REUSEPORT before running the
> program, and use the same check in reuseport_stop_listen_sock().
> Socket filters can still be attached and used as selectors; the
> selection path is unchanged.
>
> Fixes: d5e4ddaeb6ab ("bpf: Support socket migration by eBPF.")
> Signed-off-by: Linux kernel audit <audit@example.invalid>

[Severity: High]
The Signed-off-by trailer uses a placeholder identity and a non-routable
.invalid email address instead of a real developer name and routable
email address as required by the Developer's Certificate of Origin.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261115152408.48205-1-shlomojune6@gmail.com?part=1